CVE-2025-24434:
Improper Authorization vulnerability in Magento and Adobe Commerce
9.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.45708%
CWE
Published
2/11/2025
Updated
2/28/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.4.8-beta1, < 2.4.8-beta2 | 2.4.8-beta2 |
| magento/community-edition | composer | >= 2.4.7-beta1, < 2.4.7-p4 | 2.4.7-p4 |
| magento/community-edition | composer | >= 2.4.6-p1, < 2.4.6-p9 | 2.4.6-p9 |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p11 | 2.4.5-p11 |
| magento/community-edition | composer | < 2.4.4-p12 | 2.4.4-p12 |
| magento/project-community-edition | composer | <= 2.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability involves improper authorization (CWE-285/863) leading to privilege escalation. Magento's admin controllers and API endpoints are common vectors for such issues. The listed functions are inferred based on patterns in historical Magento vulnerabilities (e.g., missing _isAllowed() checks in controllers, weak authentication logic, or API ACL bypasses). Without patch/diff data, confidence remains medium, as these are educated guesses aligned with the described attack vector (session takeover via authorization bypass).